Configure Adyen webhook notifications for payment events and verify HMAC signatures in your backend

Steps

1. In the Adyen Customer Area, navigate to Developers > Webhooks and create a Standard Notification webhook pointing to your HTTPS endpoint; generate and copy the HMAC key
2. Store the HMAC key securely (e.g., in a secrets manager); Adyen signs each notification with HMAC-SHA256 using this key and includes the signature in the additionalData.hmacSignature field
3. On your endpoint, extract the hmacSignature from the notification's additionalData and compute the HMAC-SHA256 of the canonicalised notification fields using your stored HMAC key
4. Compare your computed signature to the received hmacSignature using a constant-time comparison to prevent timing attacks; reject notifications where they do not match
5. Return a plain-text HTTP 200 response with body [accepted] to acknowledge receipt; Adyen retries notifications that do not receive this acknowledgement within the timeout window